White‑hat actors return $270 M in Bitcoin to Liquid federation

Actors describing themselves as white‑hats have returned 3,400 BTC, valued at roughly $270 million, to the Liquid federation wallet after withdrawing about 4,000 BTC in a security incident earlier this week. The return represents about 85 % of the stolen funds and paves the way for a coordinated restart of the Liquid sidechain.

Background of the incident

On Sunday, a breach allowed the withdrawal of approximately 4,000 BTC from Liquid’s federation wallet, which held around 4,200 BTC at the time. The funds were moved using SideSwap’s Peg‑out Authorization Key, though both Liquid and SideSwap said the key itself was not compromised. The withdrawal was linked to a bug in Elements, the open‑source software that underpins Liquid.

Return of the majority of funds

Blockstream confirmed that the affected bridge nodes have been patched and that updated software has been deployed across the federation. Following this, the actors sent back 3,400 BTC to the federation’s address. About 598 BTC remains unreturned.

Statements from Liquid and Blockstream

Samson Mow, CEO of Liquid, said the network remains paused while further fixes, security improvements, and a chain‑split resolution are completed. He advised users not to send Bitcoin to Liquid peg‑in addresses until the restart is officially confirmed.

Controversy over the “white‑hat” label

Ledger’s CTO, Charles Guillemet, questioned the characterization of the actors as white‑hats, noting that the remaining 598 BTC could be viewed as a negotiated reward, which he described as “more like extortion than white‑hat hacking.” Neither Blockstream nor Liquid disclosed any bounty terms for the outstanding Bitcoin.

Next steps for the Liquid network

Federation members are preparing for a coordinated restart once all nodes have installed the patch and security measures are verified. No further user action is required beyond the advised pause on peg‑in transactions.